Static task
static1
Behavioral task
behavioral1
Sample
a7623f61db592847e65b21b289caab36fd46b80f59648a209d4aa53663d1cbc9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a7623f61db592847e65b21b289caab36fd46b80f59648a209d4aa53663d1cbc9.exe
Resource
win10v2004-20220812-en
General
-
Target
a7623f61db592847e65b21b289caab36fd46b80f59648a209d4aa53663d1cbc9
-
Size
87KB
-
MD5
b93df536bd7f86a3f761d2b6310a385e
-
SHA1
b0806d78ace707049615cf658d4e8b1becf9a36b
-
SHA256
a7623f61db592847e65b21b289caab36fd46b80f59648a209d4aa53663d1cbc9
-
SHA512
15aa7b0cfa0835992476325d377d8bd98919c3414c122a804c820d719e75cf308129f3439d4eea6bfbc5b313ef3ade95ee477a9e91364f8dfbb3b7df112b9def
-
SSDEEP
1536:iMmyuMYcd2lOc/rpmP2nyL00Pu4yO02apXADeJdue0xRAp/OcK0Ww:PuM7d2lOcDkCEmhESJdoxRAp/OL0
Malware Config
Signatures
Files
-
a7623f61db592847e65b21b289caab36fd46b80f59648a209d4aa53663d1cbc9.exe windows x86
2ffa368b82e6e6a0b237feace296c1ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDiskFreeSpaceExA
ReadConsoleOutputW
GetTempFileNameW
GlobalCompact
lstrlenW
WriteConsoleInputA
GetLogicalDrives
EnumCalendarInfoW
TlsFree
SetCalendarInfoW
SetFilePointer
GetCurrentProcessId
GetEnvironmentStringsA
GetBinaryTypeW
WritePrivateProfileStructW
GetDefaultCommConfigA
LocalShrink
SetSystemTime
SetErrorMode
GetSystemTime
WriteTapemark
GetExitCodeThread
Heap32ListNext
FlushViewOfFile
GetStdHandle
GetAtomNameW
SetProcessShutdownParameters
EnumResourceLanguagesW
CopyFileExA
VirtualAlloc
lstrlen
SetThreadPriorityBoost
GetEnvironmentStringsW
MapViewOfFile
GetWindowsDirectoryW
GetCommConfig
IsSystemResumeAutomatic
GlobalHandle
GetProcessTimes
GetThreadPriority
SetConsoleCtrlHandler
SetEndOfFile
GetThreadTimes
RequestWakeupLatency
GetPrivateProfileStructW
SleepEx
IsBadStringPtrA
WriteFileGather
ReadConsoleW
EscapeCommFunction
CreateWaitableTimerW
GetConsoleCP
GetMailslotInfo
CreateThread
SetupComm
GetModuleFileNameA
SearchPathA
FindResourceA
WaitForMultipleObjects
UnlockFile
GetSystemPowerStatus
EnumResourceTypesW
ResetWriteWatch
GetOverlappedResult
GetPrivateProfileIntW
CopyFileExW
EnumResourceNamesW
GetProfileIntA
AllocConsole
LocalFree
DuplicateHandle
WriteProfileSectionW
GetModuleHandleA
FreeResource
SetConsoleCursorPosition
CreateNamedPipeW
LoadModule
GetDateFormatA
GetCommModemStatus
Heap32ListFirst
GetCurrentDirectoryA
DebugActiveProcess
SetPriorityClass
OpenEventW
FindNextFileW
GetDiskFreeSpaceExW
EnumSystemCodePagesA
LoadLibraryExA
SetFileAttributesA
IsValidLocale
CreateNamedPipeA
SetCommState
GetOEMCP
CompareStringA
GetProfileStringA
GetProcessAffinityMask
GetProcessWorkingSetSize
Process32Next
GlobalAddAtomA
ConvertThreadToFiber
MoveFileExA
ReadConsoleOutputCharacterA
GetTempPathW
GetHandleInformation
GetCurrencyFormatA
GetVolumeInformationA
GetEnvironmentVariableA
HeapUnlock
EnumDateFormatsA
lstrcpynA
GetCurrentThreadId
GlobalUnlock
WriteConsoleOutputCharacterW
CreateSemaphoreW
GetCalendarInfoW
CreateProcessA
WaitForSingleObjectEx
BackupWrite
CreateFileW
SetCommTimeouts
GetVersionExW
GetNamedPipeInfo
ExpandEnvironmentStringsW
FreeEnvironmentStringsW
CreateConsoleScreenBuffer
lstrcat
LockFile
GenerateConsoleCtrlEvent
GetLogicalDriveStringsA
ReadDirectoryChangesW
lstrcpyW
GetConsoleTitleA
FindFirstChangeNotificationA
lstrcpyA
SetConsoleScreenBufferSize
IsBadCodePtr
CreateToolhelp32Snapshot
FindNextFileA
GetCompressedFileSizeW
SizeofResource
SetVolumeLabelA
GetFileAttributesA
ReleaseSemaphore
VirtualProtect
advapi32
RegSetKeySecurity
RegOpenKeyW
RevertToSelf
RegisterEventSourceA
CreateServiceA
RegEnumKeyExA
RegDeleteValueA
BuildExplicitAccessWithNameA
CryptContextAddRef
ObjectDeleteAuditAlarmW
LookupPrivilegeNameA
CryptSignHashW
RegDeleteValueW
InitializeSecurityDescriptor
SetServiceObjectSecurity
LookupAccountNameA
LookupSecurityDescriptorPartsA
RegLoadKeyW
CryptGetDefaultProviderA
RegUnLoadKeyW
BuildImpersonateTrusteeW
CryptSignHashA
GetMultipleTrusteeOperationW
ReadEventLogA
AllocateAndInitializeSid
ObjectOpenAuditAlarmA
RegSetValueA
BuildImpersonateTrusteeA
BuildImpersonateExplicitAccessWithNameW
ObjectCloseAuditAlarmA
CryptSetProvParam
IsValidAcl
CryptVerifySignatureA
RegConnectRegistryW
CryptGetUserKey
GetSecurityInfoExW
BuildTrusteeWithNameW
RegEnumKeyW
SetThreadToken
QueryServiceObjectSecurity
SetFileSecurityW
GetNamedSecurityInfoA
GetSidIdentifierAuthority
OpenEventLogW
BuildTrusteeWithSidW
GetOverlappedAccessResults
GetMultipleTrusteeOperationA
StartServiceA
RegDeleteKeyA
MapGenericMask
SetSecurityDescriptorOwner
ObjectDeleteAuditAlarmA
EnumServicesStatusW
CryptSetKeyParam
SetEntriesInAuditListA
RegisterEventSourceW
SetEntriesInAclW
CryptEnumProviderTypesA
CryptGetKeyParam
SetEntriesInAuditListW
AreAnyAccessesGranted
SetNamedSecurityInfoA
GetEffectiveRightsFromAclW
EnumDependentServicesA
CryptAcquireContextW
StartServiceW
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
ObjectOpenAuditAlarmW
GetCurrentHwProfileA
GetOldestEventLogRecord
BuildImpersonateExplicitAccessWithNameA
GetNamedSecurityInfoExW
OpenSCManagerW
CreateProcessAsUserW
RegGetKeySecurity
CryptDuplicateHash
GetEffectiveRightsFromAclA
QueryServiceLockStatusA
CryptEnumProviderTypesW
GetPrivateObjectSecurity
OpenBackupEventLogW
RegSetValueExW
GetAce
LookupAccountSidA
LogonUserA
CryptEnumProvidersA
EqualPrefixSid
RegSaveKeyA
LookupSecurityDescriptorPartsW
RegQueryInfoKeyA
RegOpenKeyA
ChangeServiceConfigA
RegNotifyChangeKeyValue
UnlockServiceDatabase
GetAuditedPermissionsFromAclA
ConvertSecurityDescriptorToAccessNamedA
AdjustTokenGroups
LockServiceDatabase
TrusteeAccessToObjectW
DeregisterEventSource
GetSecurityDescriptorDacl
DestroyPrivateObjectSecurity
GetTrusteeTypeW
BuildSecurityDescriptorW
CryptReleaseContext
QueryServiceStatus
CryptCreateHash
BuildTrusteeWithSidA
BackupEventLogW
OpenBackupEventLogA
ObjectPrivilegeAuditAlarmW
CryptExportKey
RegQueryInfoKeyW
AddAce
GetFileSecurityW
RegSetValueExA
RegReplaceKeyA
GetNamedSecurityInfoW
BuildSecurityDescriptorA
QueryServiceConfigW
ReadEventLogW
RegSetValueW
ConvertAccessToSecurityDescriptorA
RegEnumKeyExW
RegQueryValueExA
ole32
OleRegEnumFormatEtc
IIDFromString
CoFreeLibrary
CreateDataAdviseHolder
CoGetCallerTID
StgIsStorageILockBytes
StgOpenStorageEx
UtConvertDvtd32toDvtd16
OleLoad
CoFileTimeToDosDateTime
ReadClassStm
CoImpersonateClient
ReadStringStream
CreateGenericComposite
PropVariantClear
OleCreateEmbeddingHelper
CoUnmarshalInterface
CoDosDateTimeToFileTime
WriteOleStg
OleGetAutoConvert
WriteClassStg
CoRegisterSurrogate
CoRegisterChannelHook
OleFlushClipboard
CreateItemMoniker
UtConvertDvtd16toDvtd32
GetClassFile
OleCreateLinkFromDataEx
RegisterDragDrop
DoDragDrop
ReadFmtUserTypeStg
DllDebugObjectRPCHook
StringFromCLSID
CoInitialize
MonikerRelativePathTo
CoMarshalHresult
CoGetPSClsid
CoCopyProxy
OleDuplicateData
CoAddRefServerProcess
CoGetInterfaceAndReleaseStream
SetDocumentBitStg
OleCreateLink
MkParseDisplayName
OleSetClipboard
CoCreateInstanceEx
IsAccelerator
WriteClassStm
OleSetAutoConvert
GetHGlobalFromILockBytes
OleSetContainedObject
ReleaseStgMedium
StgSetTimes
CoSuspendClassObjects
CreatePointerMoniker
UpdateDCOMSettings
OleTranslateAccelerator
StgCreateDocfile
CoQueryAuthenticationServices
StringFromIID
OleCreateLinkEx
CoLockObjectExternal
OleBuildVersion
GetHookInterface
CoMarshalInterface
CoRevokeClassObject
CoCreateInstance
IsEqualGUID
OpenOrCreateStream
CoFreeAllLibraries
EnableHookObject
CoRevertToSelf
BindMoniker
CoGetCallContext
ReadClassStg
OleUninitialize
CoReleaseServerProcess
CreateOleAdviseHolder
OleDestroyMenuDescriptor
StgOpenAsyncDocfileOnIFillLockBytes
CoResumeClassObjects
OleCreateDefaultHandler
CreateAntiMoniker
StgGetIFillLockBytesOnFile
OleCreateMenuDescriptor
RevokeDragDrop
OleMetafilePictFromIconAndLabel
CreateBindCtx
OleSetMenuDescriptor
OleCreateFromFile
UtGetDvtd16Info
CreateObjrefMoniker
OleCreateLinkToFileEx
CoGetTreatAsClass
CLSIDFromProgID
CoTaskMemFree
OleIsRunning
CoIsOle1Class
OleGetIconOfFile
CoQueryClientBlanket
StgCreateStorageEx
shlwapi
StrCmpNIA
SHRegQueryUSValueA
UrlIsNoHistoryA
StrToIntExW
SHCopyKeyW
PathSetDlgItemPathA
PathCanonicalizeW
PathSetDlgItemPathW
PathMakePrettyA
PathFindExtensionW
PathIsUNCServerShareA
PathIsNetworkPathA
StrRChrIW
SHRegCloseUSKey
PathCommonPrefixA
StrTrimA
ColorAdjustLuma
UrlGetPartW
SHSetValueA
wnsprintfW
PathIsRelativeW
StrFormatByteSizeW
UrlIsOpaqueA
ColorHLSToRGB
SHRegEnumUSValueA
PathIsUNCServerW
PathGetDriveNumberW
UrlApplySchemeW
PathRemoveArgsW
PathMakeSystemFolderA
SHRegWriteUSValueW
StrRetToBufA
StrCpyW
PathIsSystemFolderW
StrStrW
PathIsURLA
SHIsLowMemoryMachine
SHQueryInfoKeyA
StrStrIW
StrFromTimeIntervalA
SHEnumValueW
SHEnumValueA
PathIsUNCServerA
StrChrW
PathSearchAndQualifyA
PathIsContentTypeW
SHSkipJunction
SHRegCreateUSKeyA
PathStripToRootW
UrlHashA
SHRegEnumUSValueW
PathIsRootW
PathGetCharTypeA
UrlCompareW
UrlIsOpaqueW
PathRelativePathToW
PathRenameExtensionA
PathIsLFNFileSpecA
StrRStrIA
ColorRGBToHLS
SHRegEnumUSKeyA
UrlGetPartA
PathRemoveArgsA
SHRegGetUSValueW
StrStrIA
StrRetToBufW
PathRelativePathToA
SHRegWriteUSValueA
UrlHashW
SHRegDeleteUSValueW
UrlCreateFromPathA
SHGetInverseCMAP
AssocQueryStringByKeyW
PathSearchAndQualifyW
SHRegDeleteUSValueA
UrlGetLocationA
PathIsDirectoryEmptyA
SHStrDupW
PathAppendA
StrPBrkW
PathUnmakeSystemFolderW
SHRegDeleteEmptyUSKeyW
PathMatchSpecA
UrlCanonicalizeA
UrlCombineW
PathRemoveFileSpecW
SHRegOpenUSKeyA
SHRegGetBoolUSValueA
StrIsIntlEqualA
PathBuildRootA
PathIsPrefixA
StrIsIntlEqualW
StrCmpNW
IntlStrEqWorkerW
StrTrimW
StrSpnW
SHRegGetUSValueA
PathUndecorateW
SHAutoComplete
ChrCmpIA
SHSetThreadRef
PathIsDirectoryA
StrChrIW
SHEnumKeyExW
SHOpenRegStreamA
StrFormatByteSize64A
StrToIntA
SHSetValueW
PathUnquoteSpacesA
PathCreateFromUrlW
SHRegQueryInfoUSKeyA
PathAppendW
StrToIntExA
PathIsUNCW
PathUnquoteSpacesW
PathGetArgsA
SHOpenRegStream2A
PathCompactPathExW
PathIsPrefixW
PathFindSuffixArrayA
PathMakePrettyW
user32
SetWindowsHookExA
ModifyMenuW
GetMessagePos
CreateAcceleratorTableA
EnumClipboardFormats
SetUserObjectInformationA
SetClassLongA
DdeAddData
FindWindowExW
InvertRect
PackDDElParam
SetMessageQueue
DefFrameProcA
WINNLSEnableIME
ScreenToClient
DispatchMessageA
MessageBoxA
ClipCursor
DrawIcon
GetWindowModuleFileNameW
DlgDirListComboBoxA
IsMenu
OpenClipboard
SetMenuItemInfoW
SetPropW
LookupIconIdFromDirectory
EnableWindow
ShowCursor
DragObject
SetActiveWindow
SetWindowTextA
RemovePropA
SetScrollPos
RegisterClassW
IsWindowEnabled
GetClassLongA
CharPrevA
TileChildWindows
CharUpperBuffW
GetUpdateRect
CreateWindowExA
GetClipCursor
DrawStateA
GetSysColorBrush
GetScrollBarInfo
DdeInitializeA
GetCursorPos
GetMenuItemID
IsCharUpperW
CreateDesktopA
GetDlgItemInt
LoadImageA
IsDialogMessage
UnhookWindowsHookEx
MonitorFromWindow
GetDlgItemTextA
UnionRect
SwitchDesktop
GetTabbedTextExtentW
GetClipboardOwner
CharToOemBuffW
GetClassInfoExA
SetWindowPlacement
SetClipboardData
DrawTextW
MapVirtualKeyW
SetUserObjectSecurity
InsertMenuA
GetMenuInfo
WINNLSGetIMEHotkey
CreateMDIWindowW
SetWindowsHookW
TabbedTextOutW
DefDlgProcA
GetForegroundWindow
DdeConnect
DlgDirSelectExW
RedrawWindow
SetScrollInfo
DdeImpersonateClient
AttachThreadInput
GetInputState
DdeClientTransaction
CopyRect
GetKeyboardLayoutNameW
GetAsyncKeyState
ToAsciiEx
GetFocus
GetPropW
InvalidateRect
DrawFocusRect
TrackPopupMenu
GetKeyboardLayout
CreateMDIWindowA
GetClassWord
SetTimer
UpdateWindow
IsCharAlphaNumericA
GetMenuItemCount
SendIMEMessageExA
LoadMenuIndirectW
SendNotifyMessageW
OemToCharBuffA
WinHelpW
SetParent
DeferWindowPos
LoadKeyboardLayoutW
SendDlgItemMessageW
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE